In visual recognition, deep neural networks (DNNs) are not robust against perturbations—either adversarially constructed or naturally occurring—that are easily discounted by human perception [1]}, [2]}. To formalize robustness, one popular way is the adversarial loss defined as [3]}
\( \begin{split}\max _{x^{\prime }} \ell {y, f_{\theta }(x^{\prime })} \quad \operatorname{s.t.}\; x^{\prime } \in \Delta (x) = \lbrace x^{\prime } \in [0, 1]^n: d{x, x^{\prime }} \le {\epsilon }\rbrace ,\end{split}\) 
